Fresh Install: There was a security error when trying to login

Zen Cart: 1.3.9h
PHP: 5.3.2
MySQL: 5.1.41
Apache 2.2.14

Fresh install (not an upgrade) on a new server. Followed all the instructions. The only step that wasn't specifically spelled out was the installer complained about the lack of configure.php files, so I renamed the dist-configure.php files accordingly. Everything was green on the system check (except GD). Install went smooth. Try to login to admin and I get: "There was a security error when trying to login".

Searched the forums and found many threads reporting this error. Read through a bunch, mainly seemed to be upgrade issues... which doesn't apply (that I can tell).

Wiped the install and redid everything thinking maybe I'd made an error, got the same thing. Annoyed.

Any suggestions?

If I create a user account and try to login, same thing: There was a security error when trying to login.

Yikes.

Chrome: "There was a security error when trying to login"
Safari: "There was a security error when trying to login"
Firefox: Works fine.

Seriously? Is this known not to work on Chrome or Safari?

A fresh install of v1.3.9h here works just fine in Chrome, Safari, Firefox, IE.

Not sure why it would matter, but I get the error using Chrome on OS X and Ubuntu and with Safari on OS X. I'm guessing from your including IE on the list that your are on Windows.

Actually, no, I'm using OS X, and have a windoze test pc I use when I want to test in IE.

Hi Nuance, did you manage to find a fix to this. I'm experiencing the same problem.

Brand new install of 1.3.9h, I've searched the forum and as you pointed out most problems appear to be with upgrades.

I've put a few mods on it but none affect includes/functions/session.php or includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php. Fast & Easy Checkout does modify includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php but I've checked it and it does seem to have <?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?> after where it says password (mind you I don't really know what I'm doing, but it looks to me like it's there)

here's what's in that file:

<?php
/**
 * Page Template
 *
 * @package templateSystem Easy Sign-Up and Login
 * @copyright Copyright 2007-2008 Numinix Technology http://www.numinix.com
 * @copyright Copyright 2003-2007 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: tpl_login_default.php 101 2010-01-28 20:50:41Z numinix $
 */
?>
<div id="centerColumn">
<?php if ($messageStack->size('login') > 0) echo $messageStack->output('login'); ?>
<?php if (FEC_EASY_SIGNUP_STATUS == 'true') { ?>
  <!-- BOF SHOPPING CART -->
  <?php
    if ($fec_order_total_enabled) {
      include(DIR_WS_TEMPLATE . 'templates/fec/tpl_modules_esl_ordertotal.php');
    } 
  ?>
  <!-- EOF SHOPPING CART -->
  <div id="easySignUp">
    <div id="loginColumnLeft">
    <!-- BEGIN CHECKOUT WITHOUT ACCOUNT -->
    <?php
      if (FEC_NOACCOUNT_SWITCH == 'true' && FEC_NOACCOUNT_POSITION == 'top') {
        if ($_SESSION['cart']->count_contents() > 0) { ?>
          <fieldset class="loginFieldsetLeft">
          <legend><?php echo COWOA_HEADING; ?></legend>
          <div class="clearBoth"></div>
          <div class="information"><?php echo TEXT_RATHER_COWOA; ?></div>
          <div class="buttonRow forward">
          <?php echo "<a href=\"" . zen_href_link(FILENAME_NO_ACCOUNT, '', 'SSL') . "\">"; ?>
          <?php echo zen_image_button(BUTTON_IMAGE_CONTINUE, BUTTON_CONTINUE_ALT); ?></a></div>
          </fieldset>
    <?php }} ?>
    <!-- END CHECKOUT WITHOUT ACCOUNT -->
    <!--BOF PPEC split login- DO NOT REMOVE-->
    <fieldset class="loginFieldsetLeft">
    <legend><?php echo HEADING_NEW_CUSTOMER_SPLIT; ?></legend>
    <div class="clearBoth"></div>
    <?php if ($_SESSION['cart']->count_contents() > 0) { ?>
    <div class="information"><?php echo TEXT_NEW_CUSTOMER_INTRODUCTION_SPLIT_NO_CART; ?></div>
    <?php } else { ?>
    <div class="information"><?php echo TEXT_NEW_CUSTOMER_INTRODUCTION_SPLIT; ?></div>
    <?php } ?>
    <hr />
    <?php echo zen_draw_form('create_account', zen_href_link(FILENAME_LOGIN, '', 'SSL'), 'post', 'onsubmit="return check_form(create_account);"') . '<div>' . zen_draw_hidden_field('action', 'process') . zen_draw_hidden_field('email_format', $email_format); ?>
    <?php require($template->get_template_dir('tpl_modules_create_account.php',DIR_WS_TEMPLATE, $current_page_base,'templates'). '/tpl_modules_create_account.php'); ?>
    <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_SUBMIT, BUTTON_SUBMIT_ALT); ?></div>
    </div>
    </form>
    </fieldset>
    </div> 
    <!-- end columnLeft -->
    <div id="loginColumnRight">
    <fieldset class="loginFieldsetRight">  
      <legend><?php echo HEADING_RETURNING_CUSTOMER_SPLIT; ?></legend>
      <div class="clearBoth"></div>
      <div class="information"><?php echo TEXT_RETURNING_CUSTOMER_SPLIT; ?></div>
      <div class="clearBoth"></div>
      <?php echo zen_draw_form('login', zen_href_link(FILENAME_LOGIN, 'action=process', 'SSL')); ?>
        <div>
          <label class="inputLabel" for="login-email-address"><?php echo ENTRY_EMAIL_ADDRESS; ?></label>
          <?php echo zen_draw_input_field('email_address', '', 'size="25" id="login-email-address"'); ?>
          <div class="clearBoth"></div>
          <label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>
          <?php echo zen_draw_password_field('password', '', 'size="25" id="login-password"'); ?>
          <?php 
            if (PROJECT_VERSION_MAJOR > 1 || (PROJECT_VERSION_MAJOR == 1 && substr(PROJECT_VERSION_MINOR, 0, 3) >= 3.8)) { 
              echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); 
            }
          ?>  
          <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_LOGIN, BUTTON_LOGIN_ALT); ?></div>
        </div>
      </form> 
    </fieldset>
    <div class="buttonRow forward important"><?php echo '<a href="' . zen_href_link(FILENAME_PASSWORD_FORGOTTEN, '', 'SSL') . '">' . TEXT_PASSWORD_FORGOTTEN . '</a>'; ?></div>
    <br class="clearBoth" />
    <!-- BEGIN CHECKOUT WITHOUT ACCOUNT -->
    <?php
      if (FEC_NOACCOUNT_SWITCH == 'true' && FEC_NOACCOUNT_POSITION == 'side') {
        if ($_SESSION['cart']->count_contents() > 0) { ?>
          <fieldset class="loginFieldsetRight">
          <legend><?php echo COWOA_HEADING; ?></legend>
          <div class="clearBoth"></div>
          <div class="information"><?php echo TEXT_RATHER_COWOA; ?></div>
          <div class="buttonRow forward">
          <?php echo "<a href=\"" . zen_href_link(FILENAME_NO_ACCOUNT, '', 'SSL') . "\">"; ?>
          <?php echo zen_image_button(BUTTON_IMAGE_CONTINUE, BUTTON_CONTINUE_ALT); ?></a></div>
          </fieldset>
          <br class="clearBoth" /> 
    <?php }} ?>
    <!-- END CHECKOUT WITHOUT ACCOUNT -->
    <!-- BOF PAYPAL -->
    <?php // ** BEGIN PAYPAL EXPRESS CHECKOUT ** 
    ?>
    <?php if ($ec_button_enabled) { ?>
    <fieldset class="loginFieldsetRight">
    <legend><?php echo HEADING_PAYPAL; ?></legend>
    <div class="clearBoth"></div>
    <div class="information"><?php echo TEXT_PAYPAL_INTRODUCTION_SPLIT; ?></div>
    <div class="clearBoth"></div>
    <div class="center"><?php require(DIR_FS_CATALOG . DIR_WS_MODULES . 'payment/paypal/tpl_ec_button.php'); ?></div>
    </fieldset>
    <div class="clearBoth"></div>
    <?php } ?>
    <?php // ** END PAYPAL EXPRESS CHECKOUT ** 
    ?>
    <!-- EOF PAYPAL -->
    <?php if (FEC_CONFIDENCE == 'true') { ?> 
      <fieldset class="loginFieldsetRight">
        <legend><?php echo HEADING_CONFIDENCE; ?></legend>
        <p>Enter some text or show images here that will help to boost customer confidence</p>
      </fieldset>
    <?php } ?>
    </div> <!-- end columnRight -->
    <!--EOF PPEC split login- DO NOT REMOVE-->
  </div>
<?php } elseif (USE_SPLIT_LOGIN_MODE == 'True' || $ec_button_enabled) { ?>
  <!--BOF PPEC split login- DO NOT REMOVE-->
  <fieldset class="floatingBox back">
  <legend><?php echo HEADING_NEW_CUSTOMER_SPLIT; ?></legend>
  <?php // ** BEGIN PAYPAL EXPRESS CHECKOUT ** ?>
  <?php if ($ec_button_enabled) { ?>
  <div class="information"><?php echo TEXT_NEW_CUSTOMER_INTRODUCTION_SPLIT; ?></div>

    <div class="center"><?php require(DIR_FS_CATALOG . DIR_WS_MODULES . 'payment/paypal/tpl_ec_button.php'); ?></div>
  <hr />
  <?php echo TEXT_NEW_CUSTOMER_POST_INTRODUCTION_DIVIDER; ?>
  <?php } ?>
  <?php // ** END PAYPAL EXPRESS CHECKOUT ** ?>
  <div class="information"><?php echo TEXT_NEW_CUSTOMER_POST_INTRODUCTION_SPLIT; ?></div>

  <?php echo zen_draw_form('create', zen_href_link(FILENAME_CREATE_ACCOUNT, '', 'SSL')); ?>
  <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_CREATE_ACCOUNT, BUTTON_CREATE_ACCOUNT_ALT); ?></div>
  </form>
  </fieldset>

  <fieldset class="floatingBox forward">
  <legend><?php echo HEADING_RETURNING_CUSTOMER_SPLIT; ?></legend>
  <div class="information"><?php echo TEXT_RETURNING_CUSTOMER_SPLIT; ?></div>

  <?php echo zen_draw_form('login', zen_href_link(FILENAME_LOGIN, 'action=process', 'SSL')); ?>
  <label class="inputLabel" for="login-email-address"><?php echo ENTRY_EMAIL_ADDRESS; ?></label>
  <?php echo zen_draw_input_field('email_address', '', 'size="18" id="login-email-address"'); ?>
  <br class="clearBoth" />

  <label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>
  <?php echo zen_draw_password_field('password', '', 'size="18" id="login-password"'); ?>
  <?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?>
  <br class="clearBoth" />

  <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_LOGIN, BUTTON_LOGIN_ALT); ?></div>
  <div class="buttonRow back important"><?php echo '<a href="' . zen_href_link(FILENAME_PASSWORD_FORGOTTEN, '', 'SSL') . '">' . TEXT_PASSWORD_FORGOTTEN . '</a>'; ?></div>
  </form>
  </fieldset>
  <br class="clearBoth" />
  <!--EOF PPEC split login- DO NOT REMOVE-->
<?php } else { ?>
  <!--BOF normal login-->
  <?php
    if ($_SESSION['cart']->count_contents() > 0) {
  ?>
  <div class="advisory"><?php echo TEXT_VISITORS_CART; ?></div>
  <?php
    }
  ?>
  <?php echo zen_draw_form('login', zen_href_link(FILENAME_LOGIN, 'action=process', 'SSL')); ?>
  <fieldset>
  <legend><?php echo HEADING_RETURNING_CUSTOMER; ?></legend>
  <label class="inputLabel" for="login-email-address"><?php echo ENTRY_EMAIL_ADDRESS; ?></label>
  <?php echo zen_draw_input_field('email_address', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_email_address', '40') . ' id="login-email-address"'); ?>
  <div class="clearBoth"></div>
  <?php if (FEC_CONFIRM_EMAIL == 'true') { ?>
    <label class="inputLabel" for="login-email-address-confirm"><?php echo ENTRY_EMAIL_ADDRESS_CONFIRM; ?></label>
    <?php echo zen_draw_input_field('email_address_confirm', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_email_address', '40') . ' id="login-email-address-confirm"'); ?>
    <div class="clearBoth"></div>    
  <?php } ?>
  <label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>
  <?php echo zen_draw_password_field('password', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_password') . ' id="login-password"'); ?>
  <div class="clearBoth"></div>
  <?php 
    if (PROJECT_VERSION_MAJOR == '1' && substr(PROJECT_VERSION_MINOR, 0, 3) == '3.8') {
      echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']);
    }
  ?>
  </fieldset>
  <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_LOGIN, BUTTON_LOGIN_ALT); ?></div>
  <div class="buttonRow back important"><?php echo '<a href="' . zen_href_link(FILENAME_PASSWORD_FORGOTTEN, '', 'SSL') . '">' . TEXT_PASSWORD_FORGOTTEN . '</a>'; ?></div>
  </form>
  <div class="clearBoth"></div>
  <!-- BEGIN CHECKOUT WITHOUT ACCOUNT -->
  <?php
    if (FEC_NOACCOUNT_SWITCH == 'true') {
      if ($_SESSION['cart']->count_contents() > 0) { ?>
         <fieldset>
        <legend>Checkout Without Account</legend>
        <?php echo TEXT_RATHER_COWOA; ?>
        <div class="buttonRow forward">
        <?php echo "<a href=\"" . zen_href_link(FILENAME_NO_ACCOUNT, '', 'SSL') . "\">"; ?>
        <?php echo zen_image_button(BUTTON_IMAGE_CONTINUE, BUTTON_CONTINUE_ALT); ?></a></div>
        <div class="clearBoth"></div>
        </fieldset>
  <?php }} ?>
  <!-- END CHECKOUT WITHOUT ACCOUNT -->
  <?php echo zen_draw_form('create_account', zen_href_link(FILENAME_CREATE_ACCOUNT, '', 'SSL'), 'post', 'onsubmit="return check_form(create_account);"') . '<div>' . zen_draw_hidden_field('action', 'process') . zen_draw_hidden_field('email_pref_html', 'email_format') . '</div>'; ?>
  <fieldset>
  <legend><?php echo HEADING_NEW_CUSTOMER; ?></legend>
  <div class="information"><?php echo TEXT_NEW_CUSTOMER_INTRODUCTION; ?></div>
  <?php require($template->get_template_dir('tpl_modules_create_account.php',DIR_WS_TEMPLATE, $current_page_base,'templates'). '/tpl_modules_create_account.php'); ?>
  </fieldset>
  <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_SUBMIT, BUTTON_SUBMIT_ALT); ?></div>
  </form>
  <!--EOF normal login-->
<?php } ?>
</div>
 <?php
// ** GOOGLE CHECKOUT **
if (strtolower(MODULE_PAYMENT_GOOGLECHECKOUT_STATUS) == 'true') {
?>
  <div id="googleCheckout">
  <?php
    include(DIR_WS_MODULES . 'show_google_components.php');
  ?>
  </div>
<?php
}
// ** END GOOGLE CHECKOUT **
?>

Can anyone help me out?

thanks

Did you enable SSL without actually having SSL for your site?

Vger

Do you live in Sweden?

SSL is installed on my site and appears to be working ok. The url is https://www.lordlaird.co.uk feel free to make an account if that helps.

Hey there, no I'm not in Sweden I'm in northern ireland

If you switch to Classic template, instead of your custom template, does the problem continue?
If you get rid of FEC, does the problem continue?

Your Full SSL Cert works fine on https://lordlaird.co.uk - and it seems that your problem is only when you try to login to your Zen Cart 'admin' folder.

Most SSL Certificates work fine with both https://www.yourdomain.com and with just https://yourdomain.com - but your site uses a cheap GoDaddy SSL Cert and they may only work with one or the other but not both.

As your SSL Cert is made out to lordlaird.co.uk and not to https://www.lordlaird.co.uk please check your admin/includes/configure.php file to see what you have entered there for your https entries.

Vger

DrByte:

If you switch to Classic template, instead of your custom template, does the problem continue?
If you get rid of FEC, does the problem continue?

Please don't tell me off for this but instead of creating my custom template like I'm supposed to I just modified the classic template. So I can't change templates to check. If I turn FEC off though the problem does still happen.

Your Full SSL Cert works fine on https://lordlaird.co.uk - and it seems that your problem is only when you try to login to your Zen Cart 'admin' folder.

Most SSL Certificates work fine with both https://www.yourdomain.com and with just https://yourdomain.com - but your site uses a cheap GoDaddy SSL Cert and they may only work with one or the other but not both.

As your SSL Cert is made out to lordlaird.co.uk and not to https://www.lordlaird.co.uk please check your admin/includes/configure.php file to see what you have entered there for your https entries.

Vger

My configure.php files all have lordlaird.co.uk rather than the www. version. The problem isn't with the admin though. I can login there fine. It's only when I try to login in the main login page that I get the problem. Interestingly when my session timesout and logs me off automatically I can log back in on that screen without any problems... Weird...

Is there anything else I should be checking.

Thanks for the advice so far!

zubenubi:

Please don't tell me off for this but instead of creating my custom template like I'm supposed to I just modified the classic template. So I can't change templates to check.
Okay, so then the next test is to delete the /includes/templates/classic/ folder and see what happens.
Naturally make a backup first.

Hi Dr Byte, I deleted my includes/templates/classic folder and that does seem to fix the problem, I was able to login ok. So I know that the problem is something to do with some file in that folder/subfolders but how do I go about narrowing it all down? Or do I need to be deleting each file individually and see when the problem stops?

thanks, I really appreciate your help with this.

but how do I go about narrowing it all down?

You said earlier on in this thread that you had modified that template, rather than setting up a new template. So my advice would be to restore the original classic template and instead of trying to modify it either write a new template or else buy one in.

Vger

Vger:

You said earlier on in this thread that you had modified that template, rather than setting up a new template. So my advice would be to restore the original classic template and instead of trying to modify it either write a new template or else buy one in.

Vger

Yeah I know that's what I should have done in the first place.

I've been playing around with things and I deleted my custom includes/templates/your_template/templates/tpl_login_default.php (the one FEC altered) which stops the problem, so obviously thats the problem.

It's to do with the following code

  <label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>
  <?php echo zen_draw_password_field('password', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_password') . ' id="login-password"'); ?>
  <div class="clearBoth"></div>
  <?php 
    if (PROJECT_VERSION_MAJOR == '1' && substr(PROJECT_VERSION_MINOR, 0, 3) == '3.8') {
      echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']);
    }
  ?>

I changed that to 3.9 and it works now :)

happy daze

Sounds like you're using an old version of that addon ... or they've got a bug in it, which you need to report to them to fix.

I seem to be having the same problem that he was, but I have no plugins installed on my Zen Cart besides one template (which doesn't have a tpl_login_default.php installed. I have also tried reverting to the default template and it still happens.

At first it was happening with Safari, Chrome, and any webkit browser that I was using. I spent a lot of time playing with my php.ini Apache settings as well as the Zen Cart sessions configuration in the admin panel, and I still have the same problem. Now all webkit browsers seem to work EXCEPT SAFARI. I'm doing my head in here right now because we need safari to work with our stuff because we are planning on deploying links to it on the iPad, which only allows safari as the browser.

I'm running the Zen Cart of an OpenSUSE 11.2 server.
Apache 2.2.13-2.4.1
PHP 5.3.3-0.7.1
MySQL 5.1.49-0.1.1
Zen-Cart 1.3.9h

The thing that's killing me is that it works fine with every browser but Safari, so I have to think it's problem with Safari, but nobody else seems to have this problem. Are there tips for what I should put in my Apache VHost configuration?

Do I need to set something special in my Php.ini file?

If anyone has any idea what I should do then please help because I can't figure this out.